Secure, purpose-built virtual machine images

Deploy containers on hardened, minimal VM images — rebuilt from source daily to ensure zero known CVEs — optimized for ephemeral workloads across cloud and on-premise environments.

The world’s leading companies trust Chainguard

The security and innovation-friendly container host has arrived

Simplify continuous compliance

Meet critical compliance controls by default with zero-CVE Container Hosts, Application, and Base images guarded under a CVE remediation SLA.

Engineering should build, not patch

Focus on differentiated product experiences and reduce the burden on engineering and security teams for CVE triage, management, and remediation.

Innovate without big bang upgrades

Benefit from the latest features, security updates, and performance optimizations from upstream maintainers without costly and complex major upgrades.

Purpose-built, use-case optimized

Shrink your attack surface without compromising performance with VMs that include only components required to run your containerized applications and support ephemeral cloud-native workloads.

Continuously rebuilt and updated from source

Benefit from newly available features, software upgrades, and a best-in-class CVE remediation SLA of 7 days for critical and 14 days for high, medium, and low through automated rebuilds.

Standardized for multi-cloud

Build on Chainguard VMs optimized for one-click deployments into the cloud of your choice or on-premise environment, with end-to-end integrity for every software component included in your virtual machines.

Customizable and extensible

Customize Chainguard VMs to meet organization-specific requirements without spawning additional overhead and maintenance requirements.

The Chainguard VMs difference

Proactive malware prevention

Stay protected from malicious attacks often inserted during the build and distribution stages of package creation.

Eliminate vulnerabilities

We don’t just identify OSS vulnerabilities for you to manage – we remove them entirely.

Responsibility you can trust

One reliable, secure partner with industry-leading SLAs to take on the burden of a hard, unpredictable problem.

Expertise and experience

The leading open source minds driving the industry forward, delivering new innovations for developers.

Trust in every phase of the SDLC

Frequently Asked Questions

What are Chainguard VMs?

Chainguard VMs are minimal Linux images based on Chainguard OS, available in three types:

• Container Host VMs (for running containers on ECS, EKS, EC2, GCE, Azure)

• Base VMs (customizable general-purpose - Chainguard OS, Java and Python)

• Application VMs (pre-packaged services like Nginx, Jenkins, Squid-proxy).

How do Chainguard VMs differ from general-purpose Linux distributions?

Chainguard VMs are minimal, including only the components required for ephemeral workloads (systemd, glibc, Linux kernel) while removing unnecessary packages that bloat traditional distributions.

Which cloud platforms and hypervisors support Chainguard VMs?

Chainguard VMs support major cloud providers (AWS, Azure, Google Cloud) and on-premise hypervisors (VMware, Nutanix, OpenStack, Qcow2, and RAW), with one-click deployments optimized for each environment.

What VM compliance requirements do Chainguard VMs help satisfy?

Chainguard VMs support kernel-independent FIPS 140-3-validated cryptography, allowing you to maintain FIPS compliance without kernel dependencies or dedicated FIPS-mode booting.

What's included in a minimal VM image?

Chainguard VMs include only the essential components for running containers: a Linux kernel, systemd, glibc, and optional userspace tools like SSH.

How quickly does Chainguard remediate CVEs in VM images?

Chainguard provides an industry-leading CVE remediation SLA for VMs: 7 days for critical CVEs and 14 days for high, medium, and low severity issues.

Do I need to do major OS version upgrades with Chainguard VMs?

No, Chainguard VMs use a node replacement strategy rather than in-place upgrades.

Can I use Chainguard VMs in air-gapped or on-premise environments?

Yes, Chainguard VMs support on-premise hypervisors (VMware, Nutanix, OpenStack, Qcow2, and RAW) and can be deployed in restricted network environments.